cbcvebase.
CVE-2018-19290
published 2018-11-30

CVE-2018-19290: In modules/HELPBOT_MODULE in Budabot 0.6 through 4.0, lax syntax validation allows remote attackers to perform a command injection attack against the PHP…

PriorityP260critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
4.05%
89.4th percentile
In modules/HELPBOT_MODULE in Budabot 0.6 through 4.0, lax syntax validation allows remote attackers to perform a command injection attack against the PHP daemon with a crafted command, resulting in a denial of service or possibly unspecified other impact, as demonstrated by the "!calc 5 x 5" command. In versions before 3.0, modules/HELPBOT_MODULE/calc.php has the vulnerable code; in 3.0 and above, modules/HELPBOT_MODULE/HelpbotController.class.php has the vulnerable code.

Affected

1 ranges
VendorProductVersion rangeFixed in
budabotbudabot0.6 – 4.0—

Detection & IOCsextracted from sources · hover to see the quote

command!calc 5 x 5↗
pathmodules/HELPBOT_MODULE/calc.php↗
pathmodules/HELPBOT_MODULE/HelpbotController.class.php↗
  • →Monitor private messages sent to the Budabot chatbot for the '!calc' command containing non-numeric/non-operator characters (e.g., alphabetic characters like 'x') which indicate a command injection attempt against the PHP daemon. ↗
  • →Inspect input passed to the HELPBOT_MODULE calc functionality; lax syntax validation allows injection — flag any !calc input that includes characters outside of digits, standard arithmetic operators, and whitespace. ↗
  • ·Vulnerable code exists in two different file paths depending on Budabot version: calc.php for versions before 3.0, and HelpbotController.class.php for versions 3.0 and above. Detection/patching efforts must account for both paths. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.